Looks like LDAP is trying to use extension to modify password and it fails.. Setting ldap password sync to No helps a little bit - means I can change LN/NT Passwords of course userPassword is kept unchanged.